Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit

Google Threat Intelligence Group (GTIG) identified "Coruna," a powerful iOS exploit kit targeting iPhones running iOS 13.0 through 17.2.1, containing 23 exploits across five full exploit chains.

• •The kit was used by a surveillance vendor customer in February 2025, later in watering hole attacks on Ukrainian websites by suspected Russian group UNC6353, and then by Chinese threat actor UNC6691 in broad scam campaigns.
• •Coruna includes WebKit RCE exploits, PAC bypasses, sandbox escapes, privilege escalation, and PPL bypasses, with code names like cassowary (CVE-2024-23222), Photon (CVE-2023-32434), and Gallium (CVE-2023-38606).
• •The framework fingerprints devices to select the appropriate exploit chain, bails out in Lockdown Mode or private browsing, and encrypts binary payloads with ChaCha20 using a custom file format starting with 0xf00dbeef.
• •